CVE-2024-30262

highPriorität · verfolgen · 28EPSS 0.005 · 43. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.50% (43rd) EPSS

CVSS 7.1 · high

Is it mine?

4 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · bewertet 2026-10-27

Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.9–7.1

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 4.2

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:Nsecondary · ENISA EU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 1.6 · Auswirkung 4.2

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:Nsecondary · OSV

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-613USprimärCWE-384USCWE-384USCWE-613US

betroffene Produkte (4)

Betroffene Produkte und Versionsbereiche.

contao contaoalle Versionenenisa_euvdEU
contao contao≤ < 4.13.40enisa_euvdEU
contao contao< 4.13.40nvdUScpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*
Packagist contao/core-bundle< 4.13.40osvUSpkg:composer/contao/core-bundle

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-r4r6-j2j3-7pp5Contao: Remember-me tokens will not be cleared after a password change2024-04-09ghsa · osvUS
### Impact When a front end member changes their password, the corresponding remember-me tokens are not removed. ### Patches Update to Contao 4.13.40. ### Workarounds Disable "Allow auto login" in the login module. ### References https://contao.org/en/security-advisories/remember-me-tokens-are-not-cleared-after-a-password-change ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

veröffentlicht 2024-04-09geändert 2026-06-17

verwandt (733)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2014-2595US	critical9.8	16.9% (97th)	Exploit	2020-02-12
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.
CVE-2020-27422US	critical9.8	7.86% (95th)	Exploit	2020-11-16
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
CVE-2021-24019US	critical9.8	3.90% (90th)	Exploit	2021-10-06
An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user sess…
CVE-2020-29667US	critical9.8	3.23% (88th)	Exploit	2020-12-10
In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system becaus…
CVE-2017-6529US	high8.8	2.90% (87th)	Exploit	2017-03-09
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.

+728 weitere

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan